golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension

A flaw was found in golang.org. In x/text, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension...

PT-2022-2808

Name of the Vulnerable Software and Affected Versions U-Boot version 2022.01 Description The issue is related to a buffer overflow in the CONFIG IP DEFRAG function, which is responsible for IP packet defragmentation in U-Boot bootloaders for Linux-based embedded operating systems. This is caused ...

Apple iTunes U < 3.8.3 A Vulnerability (credentialed check)

The version of Apple iTunes U installed on the remote iOS host is prior to 3.8.3. It is, therefore, affected by a vulnerability as referenced in the HT212809 advisory. - REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none...

Hardcoded credentials

Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprotected UART port on the device. The same port exposes an unauthenticated Das U-Boot BIOS shell...

CVE-2022-25213

Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprotected UART port on the device. The same port exposes an unauthenticated Das U-Boot BIOS shell...

CVE-2022-25213

CVE-2022-25213 describes improper physical access control and hard-coded credentials in /etc/passwd that allow an attacker with physical access to obtain a root shell via an unprotected UART port, which also exposes an unauthenticated Das U-Boot BIOS shell. The description applies to devices with...

CVE-2022-25213: Use of Hard-coded Credentials

Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprotected UART port on the device. The same port exposes an unauthenticated Das U-Boot BIOS shell...

SolarWinds Serv-U FTP Server 路径遍历漏洞

SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from the US-based SolarWinds. A path traversal vulnerability exists in SolarWinds Serv-U FTP Server. The vulnerability arises from a failure of a network system or product to properly filter special elements in the path...

EulerOS 2.0 SP9 : uboot-tools (EulerOS-SA-2022-1312)

According to the versions of the uboot-tools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel image because filesystem loading is...

Vulnerability of the web authentication function of the SolarWinds Serv-U File Server, which allows a hacker to increase their privileges

The vulnerability of the web authentication function of the SolarWinds Serv-U File Server exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

Design/Logic Flaw

crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of i,u64 was always the same as AtomicI,U64. However, the alignment of i,u64 on a...

CVE-2021-21962

A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A series of specially-crafted MQTT payloads can lead to remote code execution. An attacker must perform a man-in-the-middle attack in order to trigger th...

CVE-2021-21962

The provided connected documents confirm a heap-based buffer overflow in SeaConnect 370W (v1.3.34) OTA Update u-download, triggered by specially crafted MQTT payloads over a MITM position. The root cause involves the ParseToDownloadMessage path where unescape allocates a small heap buffer and une...

SolarWinds Serv-U vulnerability exploited to deliver Log4j attack

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. SolarWinds is affected by a vulnerability CVE-2021-35247 due to improper input validation when processing LDAP queries in the Serv-U web login screen. Serv-U versions up to 15.2.5 are affected by this flaw and were fixed in...

SolarWinds Serv-U Improper Input Validation Vulnerability

SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization...

Microsoft: Attackers Tried to Login to SolarWinds Serv-U Via Log4j Bug

Attackers are trying to log in to SolarWinds Serv-U file-sharing software via attacks exploiting the Log4j flaws. This is a confusing story: Initially, Microsoft had warned on Wednesday that attackers were exploiting a previously undisclosed vulnerability in the SolarWinds Serv-U file-sharing...

Hackers Attempt to Exploit New SolarWinds Serv-U Bug in Log4Shell Attacks

Microsoft on Wednesday disclosed details of a new security vulnerability in SolarWinds Serv-U software that it said was being weaponized by threat actors to propagate attacks leveraging the Log4j flaws to compromise targets. Tracked as CVE-2021-35247 CVSS score: 5.3, the issue is an "input...

Serv-U FTP Server < 15.3 Improper Input Validation

According to its banner, the installed version of Serv-U is a version prior to 15.3. It is, therefore, affected by an improper input validation vulnerability. The Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated th...

Exploit for Out-of-bounds Write in Solarwinds Serv-U

Serv-U CVE-2021-35211 Exploit Potential for DoS - check yo...

PT-2022-15164 · Intel +1 · Intel Processors +1

Name of the Vulnerable Software and Affected Versions: Intel processors based on Sunny Cove microarchitecture, including Ice Lake Xeon-SP, Ice Lake D, Gemini Lake, Ice Lake U, Y, and Rocket Lake Description: An elevation-of-privilege issue allows attackers to affect the system. The problem, known...